krab5---a---t[.]ru

The domain krab5---a---t.ru was registered through the REGRU-RU registrar on March 12, 2026. It is currently active and classified as a generic phishing threat with an elevated risk rating. DNS resolution points to the single IPv4 address 198.13.158.7, and the domain uses Cloudflare name servers identified as elijah.ns.cloudflare.com and emely.ns.cloudflare.com. VirusTotal analysis shows that 2 out of 91 security vendors have flagged the domain, indicating that at least a minority of scanners have identified malicious behavior. The domain also appears on one external security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the consensus that it is being used for malicious purposes.

Public threat intelligence sources provide limited additional context. No detailed page title, SSL certificate information, or HTTP response data have been published, so the exact content served by the site remains unknown. The lack of broader vendor detections suggests that the phishing campaign may be in an early deployment stage or that detection signatures have not yet been widely propagated. Nonetheless, the presence on a blocklist and the confirmation from multiple vendors justify a precautionary stance.

Defenders should add krab5---a---t.ru to local deny lists, enforce DNS sinkholing for the resolved IP 198.13.158.7, and monitor outbound traffic for connections to the Cloudflare name servers associated with this domain. Network intrusion detection signatures that flag HTTP requests to this host can help mitigate potential credential harvesting. Organizations using email filtering should treat any messages containing links to this domain as malicious. Continuous re‑evaluation is recommended, as additional detections may appear in future VirusTotal scans or blocklist updates.